Software development and component integration can create subtle vulnerabilities within application software, middleware or operating systems, or across their interactions with system devices and external access points. Undetected vulnerabilities can be exploited to result in capability failures, unauthorized access to resources, or “Trojan horse” types of activities. Current debugging and testing tools have not been successful in detecting and eliminating such subtle vulnerabilities. However, hackers have been able to discover such subtle vulnerabilities, even though they often do not have access to source code or system designs.
Hackers typically use vulnerability models to analyze programs for vulnerabilities. Hackers look for security vulnerabilities by performing indirect searches of system robustness and correctness. That is, they postulate the existence of a particular vulnerability, create test cases to validate or invalidate the premise, and then run the tests and check the results. Such searches, while ad hoc, are guided by complex vulnerability models (that may exist only in the minds of the hackers) comprised of low-level, idiosyncratic knowledge of system routines, object interactions, operating system characteristics, and external interfaces, augmented with run-time diagnostic data.
Typical vulnerability discovery schemes locate only known vulnerabilities (i.e., they discover vulnerabilities after hackers do). Such schemes are limited by complexity as they search for single-statement or simple-pattern vulnerabilities at a single code module (e.g., class), object, or component. Furthermore, current approaches are ad hoc, that is, they apply a case-by-case representation and analysis to each type and location of vulnerability. This makes the current approaches incapable of detecting vulnerabilities that arise from interaction flow of multiple types and locations of vulnerabilities.
State-of-the-art system development methodologies are powerful enough to identify many classes of vulnerabilities through manual design/code reviews and testing. However, other classes of vulnerabilities pass through these processes undetected. For example, since most testing focuses on generating inputs and checking outputs, ephemeral vulnerabilities are often overlooked. Other vulnerabilities avoid detection because the design or code seems to be self-verifying. Thus, testing and review may be superfluous. Still other vulnerabilities that spring from the idiosyncrasies of system and library calls, object-oriented constructs and related runtime support, low-level operating system details, or object or other external interactions, can be extremely difficult to detect, especially when these vulnerabilities are due to counter-intuitive or nonsensical combinations of such activities.
Secure systems require that integrity be maintained not only in the face of a probabilistic injection of errors and statically analyzable data streams, but malicious and devious adversaries. Therefore, simple straight-line tests and analyses are not sufficient.
The recent increasing use of object-oriented software development mitigates some vulnerabilities by helping with incremental development, information abstraction, and encapsulation. Such object-oriented development, however, exposes additional vulnerabilities that can be used to exploit the object-oriented programming constructs and runtime support features.
Once a vulnerability is discovered, it may be too costly to completely remove the vulnerability through redesign, patching, or updating software. Instead, vulnerabilities may have to be managed throughout the system lifetime.